Cyber wrap

Posted By Michael Chi on July 19, 2017 @ 13:22

Prime Minister Turnbull announced a significant restructure of Australia’s national security community and Australia’s set to get a new Office of National Intelligence with a yet-to-be-named director. The Australian Signals Directorate will be elevated to a statutory authority within Defence. And longstanding rumours of a ‘mega-department’ have come to fruition, with Immigration, the AFP and ASIO to be amalgamated into a ‘Home Office’. The special adviser to the PM on cybersecurity, Alistair MacGibbon, is slated to head the Australian Cyber Security Centre, which is poised to receive a 24/7 response capability.

Further details of the restructure, let alone its implications for cybersecurity, aren't yet clear—but the changes have been described as the most significant in 40 years. Some of the changes are in line with the recently published report of the Independent Intelligence Review (a summary of the review’s recommendations is available here), but critics have noted that the review didn’t consider or provide a recommendation for or against the amalgamation of agencies into a home affairs department, fueling concern about such a systemic change occurring without due diligence. The US also is about to get a shake-up, with US Cyber Command reportedly being split off from the National Security Agency.

The Australian government has announced that it will be introducing a new cybersecurity law that would compel tech companies and communications service providers to provide access to terrorist messaging. It’s not the first time this issue has come up, and the law comes after more than a month of foreshadowing, following the London Bridge attack earlier this year. The move has again stirred controversy over whether such cooperation is a ‘back door’ or not, and whether it can be provided without compromising security as a whole. There have been some communication issues around the issue, and one of Prime Minister Turnbull’s responses has earned the ire of most commentators, who’ve described the quip as either poorly informed, willfully ignorant or Orwellian.

On the sunnier side of cybersecurity, the NSW government is looking to invest $35 million in innovation, launching a start-up hub near Wynyard Park designed to accommodate 2,500 people. Similarly, the Government Communications Headquarters is accepting applications for the second round of its start-up accelerator program, and Dimension Data and Deakin University have launched a six-month accelerator program in Melbourne, which is hosting a series of roadshow events around the country. Sydney-based software company Atlassian has opened up its bug bounty program to the public, offering open-source researchers up to $3,000 for each vulnerability they find. And the Japanese government has announced that it will be forming a new Cybersecurity Response Center to protect critical infrastructure over the course of the Tokyo Olympic Games in 2020.

Returning to cyber law, Singapore is promulgating a new cybersecurity bill for public consultation. The new bill will introduce a new commissioner of cybersecurity, and provide measures to identify and protect critical information infrastructure across 11 essential services sectors. The Netherlands passed a new Intelligence and Security Act, introducing new powers in international intelligence-sharing and compelling service providers to retain data for three years. And well into its implementation phase is China’s new cybersecurity law—at only two months in, Apple has begun building its first data centre in China in line with data sovereignty requirements. China’s also looking at compelling communications service providers to prevent the use of virtual private networks, or VPNs, which are routinely used to evade the ‘Great Firewall’. Whether that will be a blanket ban or a permissions-based system remains unclear.

Health insurance provider Bupa suffered a major data breach after an aggrieved employee illegally copied and removed customer information from company servers. The leaking employee has been dismissed, but information about 547,000 of Bupa’s international policyholders has been leaked, including nearly 20,000 Australians. The details taken include names, dates of birth, nationalities, Bupa membership numbers, and some contact details, leading to concern that the highly valuable information will be posted for sale on the dark web. Bupa could be facing some hefty legal penalties. A similar data breach dating back to 2015 cost the parent company of Ashley Madison US$11.2 million in a settlement with 37 million affected users.

In June, false quotes from Qatar’s emir ignited an ongoing diplomatic crisis between Qatar and neighbouring states. Unnamed US intelligence officials are said to have now found evidence that the operation to plant those quotes, previously thought to have been conducted by Russia, was conducted by the United Arab Emirates government as part of a long ongoing dispute between the two countries. If that’s true, the case demonstrates the disproportionate impact a cyber offensive campaign can have, and the difficulty that defenders face in trying to identify or ‘attribute’ the attacker and respond appropriately.

LastPass, a popular password management software service, has published an infographic presenting the findings of a survey it conducted on cybersecurity practice across generations. Bangkok Post published a surprisingly close and philharmonic look at the motivations of Australia’s Cyber Ambassador and ASPI alumnus Tobias Feakin, talking about the importance of strategy and responsibility ownership in managing cybersecurity investments and tech.

Article printed from The Strategist: https://www.aspistrategist.org.au

URL to article: https://www.aspistrategist.org.au/cyber-wrap-173/

[1] announced: https://malcolmturnbull.com.au/media/a-strong-and-secure-australia

[2] the most significant in 40 years: http://www.smh.com.au/federal-politics/political-news/peter-dutton-the-big-winner-as-malcolm-turnbull-creates-home-affairs-office-20170718-gxdbou.html

[3] recently published report of the: https://www.pmc.gov.au/resource-centre/national-security/report-2017-independent-intelligence-review

[4] available here: http://www.sbs.com.au/news/article/2017/07/18/intelligence-review-urges-changes

[5] reportedly being split off from: http://hosted2.ap.org/APDEFAULT/89ae8247abe8493fae24405546e9a1aa/Article_2017-07-15-US--Military%20Cyberwar/id-009c1f7cd6a84455a849663accdae696

[6] announced: https://www.gizmodo.com.au/2017/07/everything-that-went-down-at-malcolm-turnbulls-encryption-law-announcement/

[7] not the first time: https://www.aspistrategist.org.au/going-dark-strong-encryption-security-part-1/

[8] more: https://www.aspistrategist.org.au/cyber-wrap-167/

[9] than: https://www.aspistrategist.org.au/cyber-wrap-168/

[10] month: https://www.aspistrategist.org.au/cyber-wrap-169/

[11] foreshadowing: https://www.aspistrategist.org.au/cyber-wrap-170/

[12] such cooperation is a ‘back door’ or not: http://www.abc.net.au/news/2017-07-14/encryption-laws-australia-does-government-need-a-backdoor/8709654

[13] it can be provided: https://www.aspistrategist.org.au/u-cant-touch-this-the-inviolability-of-encryption/

[14] compromising: https://au.news.yahoo.com/a/36374145/laws-to-let-spies-into-terrorists-phones/#page1

[15] one of Prime Minister Turnbull’s responses: https://twitter.com/MarkDiStef/status/885671050993737728

[16] earned: http://www.independent.co.uk/news/malcolm-turnbull-prime-minister-laws-of-mathematics-do-not-apply-australia-encryption-l-a7842946.html

[17] the: https://www.gizmodo.com.au/2017/07/prime-minister-says-the-laws-of-australia-can-beat-the-laws-of-math/

[18] ire: https://www.techly.com.au/2017/07/17/turnbull-laws-beats-math-access-encrypted-messages/

[19] most: http://www.zdnet.com/article/the-laws-of-australia-will-trump-the-laws-of-mathematics-turnbull/

[20] commentators: https://www.schneier.com/blog/archives/2017/07/australia_consi.html

[21] poorly informed: http://www.zdnet.com/article/australia-is-now-king-idiot-of-the-internet/

[22] willfully ignorant: https://www.techdirt.com/articles/20170714/10385237789/aussie-prime-minister-says-laws-math-dont-apply-australia-when-it-comes-to-encryption.shtml

[23] Orwellian: https://twitter.com/myriamrobin/status/885673412986667008?ref_src=twsrc%5Etfw&ref_url=http%3A%2F%2Fwww.independent.co.uk%2Fnews%2Fmalcolm-turnbull-prime-minister-laws-of-mathematics-do-not-apply-australia-encryption-l-a7842946.html

[24] invest $35 million: https://www.itnews.com.au/news/nsw-govt-pours-35m-into-mega-sydney-start-up-hub-468293

[25] accepting applications for the second round: https://wayra.co.uk/gchq/

[26] start-up accelerator program: http://www.computerweekly.com/news/450422512/Cyber-security-startups-urged-to-join-GCHQ-Cyber-Accelerator

[27] launched a six-month accelerator program: http://www.zdnet.com/article/dimension-data-and-deakin-university-open-cybersecurity-accelerator/

[28] series of roadshow events: https://securitybrief.co.nz/story/melbourne-accelerator-program-seeks-apac-cybersecurity-startups/

[29] opened up its bug bounty program: http://www.securityweek.com/atlassian-launches-public-bug-bounty-program

[30] offering open-source researchers: https://bugcrowd.com/atlassian

[31] forming a new Cybersecurity Response Center: http://www.japantimes.co.jp/news/2017/07/14/national/tokyo-plans-cybersecurity-hub-protect-infrastructure-2020-olympics/

[32] new bill will introduce: http://www.straitstimes.com/tech/new-cybersecurity-bill-at-a-glance

[33] new Intelligence and Security Act: https://www.rijksoverheid.nl/ministeries/ministerie-van-binnenlandse-zaken-en-koninkrijksrelaties/nieuws/2017/07/11/eerste-kamer-stemt-in-met-nieuwe-wet-op-de-inlichtingen--en-veiligheidsdiensten

[34] introducing new powers: https://www.theregister.co.uk/2017/07/13/dutch_surveillance_law_revamp/

[35] Apple has begun building its first data centre: https://www.engadget.com/2017/07/12/apple-builds-data-center-chinese-cybersecurity-rules/

[36] also looking at compelling: https://www.bloomberg.com/news/articles/2017-07-10/china-is-said-to-order-carriers-to-bar-personal-vpns-by-february

[37] permissions-based system: https://www.engadget.com/2017/07/13/china-might-not-block-personal-vpns

[38] Bupa: https://www.bupa.com/corporate/about-us/customer-update

[39] suffered a major data breach: https://www.infosecurity-magazine.com/news/bupa-employee-fired-547000/

[40] leaking employee has been dismissed: http://www.ibtimes.com/bupa-data-breach-angry-employee-deletes-records-more-500000-insurance-customers-2565556

[41] nearly 20,000 Australians: http://www.smh.com.au/business/consumer-affairs/nearly-20000-australians-caught-up-in-massive-bupa-global-data-breach-20170717-gxckbr.html

[42] cost the parent company of Ashley Madison: https://www.reuters.com/article/us-ashleymadison-settlement-idUSKBN19Z2F0

[43] are said to have now found evidence: https://www.washingtonpost.com/world/national-security/uae-hacked-qatari-government-sites-sparking-regional-upheaval-according-to-us-intelligence-officials/2017/07/16/00c46e54-698f-11e7-8eb5-cbccc2e7bfbf_story.html?utm_term=.8db770fc77dd

[44] an infographic: https://www.entrepreneur.com/article/297232

[45] findings of a survey it conducted: https://blog.lastpass.com/2017/06/infographic-online-security-through-the-ages.html/

[46] surprisingly close and philharmonic look: http://www.bangkokpost.com/business/news/1284351/australias-e-envoy